Method and system for communicating a secret

ABSTRACT

A method of communicating a secret (k0, k1) on the Bitcoin blockchain is disclosed. The method comprises sending information identifying secrets selectable by the recipient and receiving a first public key (Ui) of an elliptic curve cryptography system, corresponding to a first secret (Si) selected for access by the recipient and for which a first private key (m) is accessible to the recipient. A second public key (U1-i) is received, corresponding to a second secret not selected for access by the recipient, wherein a corresponding second private key is not available to the recipient. First and second secrets encrypted by means of the respective first and second public keys (X0, X1) are sent to the recipient, wherein the first secret is accessible to the recipient by means of the first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first and second secrets.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No. 17/055,095, filed Nov. 12, 2020, entitled “METHOD AND SYSTEM FOR COMMUNICATING A SECRET,” which is a 371 National Stage Patent Application of International Patent Application No. PCT/IB2019/053909, filed May 13, 2019, which claims priority to United Kingdom Patent Application No. 1807822.0, filed May 14, 2018, and International Patent Application No. PCT/IB2018/053359, filed May 14, 2018, the disclosures of which are incorporated herein by reference in their entirety.

TECHNICAL FIELD

The present disclosure relates to a computer implemented system and method, and more particularly to a computer implemented system and method for transferring a digital asset. The disclosure is particularly suited, but not limited to, a blockchain-based data transfer system.

BACKGROUND

In this document we use the term ‘blockchain’ to include all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction-chain technologies, permissioned and un-permissioned ledgers, shared ledgers and variations thereof. The most widely known application of blockchain technology is the Bitcoin ledger, although other blockchain implementations have been proposed and developed. While Bitcoin may be referred to herein for the purpose of convenience and illustration, it should be noted that the disclosure is not limited to use with the Bitcoin blockchain and alternative blockchain implementations and protocols fall within the scope of the present disclosure. The term “user” may refer herein to a human or a processor-based resource.

A blockchain is a peer-to-peer, electronic ledger which is implemented as a computer-based decentralised, distributed system made up of blocks which in turn are made up of transactions. Each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system, and includes at least one input and at least one output. Each block contains a hash of the previous block so that blocks become chained together to create a permanent, unalterable record of all transactions which have been written to the blockchain since its inception. Transactions contain small programs known as scripts embedded into their inputs and outputs, which specify how and by whom the outputs of the transactions can be accessed. On the Bitcoin platform, these scripts are written using a stack-based scripting language.

In order for a transaction to be written to the blockchain, it must be “validated”. Network nodes (miners) perform work to ensure that each transaction is valid, with invalid transactions rejected from the network. Software clients installed on the nodes perform this validation work on an unspent transaction (UTXO) by executing its locking and unlocking scripts. If execution of the locking and unlocking scripts evaluate to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, in order for a transaction to be written to the blockchain, it must be i) validated by the first node that receives the transaction—if the transaction is validated, the node relays it to the other nodes in the network; and ii) added to a new block built by a miner; and iii) mined, i.e. added to the public ledger of past transactions.

Although blockchain technology is most widely known for the use of cryptocurrency implementation, digital entrepreneurs have begun exploring the use of both the cryptographic security system Bitcoin is based on and the data that can be stored on the Blockchain to implement new systems. It would be highly advantageous if the blockchain could be used for automated tasks and processes which are not limited to the realm of cryptocurrency. Such solutions would be able to harness the benefits of the blockchain (e.g. a permanent, tamper proof records of events, distributed processing etc) while being more versatile in their applications.

In the case of exchange of data between parties, it is often desirable for a recipient of data files to be able to access only one, or a limited number of, files from a selection, while not enabling a sender of the data to know which file was accessed. This arrangement is known as Oblivious Transfer and is described below with reference to FIGS. 1 to 3 .

Referring to FIG. 1 , Oblivious Transfer is a method for controlling the access of a resource (a file, database record, or any other digital asset), and transferring that resource with enhanced privacy. The basic problem of Oblivious Transfer is to define a mechanism where the sender should not learn which, of many files sent to the receiver, the receiver opens. Alice is the sender, Bob is the receiver, m is a message, and b is the index of the message. Alice sends a number of messages, Bob selects which ones he wishes to receive and decode. Alice does not know which ones Bob selects.

A basic mechanism can be defined by considering Diffie-Hellman (DH) key exchange [10] with reference to FIG. 2 . It can be seen in CDH (Core Diffie Hellman) key exchange as shown in FIG. 2 that it is clear which keys are being exchanged, and therefore which message will be decrypted as a result of the Diffie Hellman protocol. C is the encrypted message, E is the encryption function, which takes the arguments of the private key K, and the message m, and D is the decryption function which takes the arguments of the encrypted message C and the private key K. Knowledge by third parties of which message is being decrypted can under certain circumstances lead to reduced security of data, which can lead to unauthorised parties accessing data.

Referring now to FIG. 3 , a variation of the DH mechanism to accommodate Oblivious Transfer is described. It can be seen that the receiver sends multiple keys back to the sender, with only one key being authentic, the others being ‘dummies’ or redundant.

The main difference between the arrangement shown in FIG. 3 and the standard core Diffie Hellman (CDH) protocol shown in FIG. 2 is that the key being passed back from Bob to Alice depends on the value of a bit ‘b’. This computation is done by Bob. Alice then constructs two keys based upon the key she received from Bob. Alice sends these two keys back to Bob. Bob is then able to decrypt the message received from Alice using the keys he received from Alice and also the key he computed from a previous value Alice passed to him. As was the case with the arrangement of FIG. 2 , E is the encryption algorithm and D is the decryption algorithm. Bob can only decrypt one of the message pairs, and the other combination is a ‘dummy’ and does not work.

It can be seen that using the variant of the Diffie-Hellman mechanism, Alice remains ‘oblivious’ of the message that Bob decrypts. In this example there is only one of two possible messages that Bob can decrypt.

Thus, it is desirable to improve data security by providing an Oblivious Transfer mechanism which is applicable to the blockchain.

Such an improved solution has now been devised.

SUMMARY

Thus, in accordance with the present disclosure there is provided a method and system as defined in the appended claims.

There may be provided a method of communicating at least one secret from a sender to a recipient, the method comprising:

-   -   sending, from the sender to the recipient, information         identifying a plurality of secrets selectable by the recipient;     -   receiving, at the sender, from the recipient, at least one first         public key, corresponding to a respective first said secret         selected for access by the recipient, wherein the or each said         first public key is part of a public key/private key pair of an         elliptic curve cryptography system and a first private key         corresponding to said first public key is accessible to the         recipient;     -   receiving, at the sender, from the recipient, at least one         second public key, corresponding to a respective second said         secret not selected for access by the recipient, wherein the or         each said second public key is a public key of said elliptic         curve cryptography system and a respective second private key,         corresponding to said second public key, is not available to the         recipient;     -   sending, from the sender to the recipient, at least one said         first secret encrypted by means of the corresponding said first         public key; and     -   sending, from the sender to the recipient, at least one said         second secret encrypted by means of the corresponding said         second public key;     -   wherein the or each said first secret is accessible to said         recipient by means of the corresponding said first private key,         the or each said second secret is inaccessible to said         recipient, and said sender is unable to distinguish between a         said first secret and a said second secret.

There may be provided a method of receiving at least one secret sent from a sender to a recipient, the method comprising:

-   -   receiving, at the recipient, information identifying a plurality         of secrets selectable by the recipient;     -   sending, to the sender, from the recipient, at least one first         public key, corresponding to a respective first said secret         selected for access by the recipient, wherein the or each said         first public key is part of a public key/private key pair of an         elliptic curve cryptography system and a first private key         corresponding to said first public key is accessible to the         recipient;     -   sending, to the sender, from the recipient, at least one second         public key, corresponding to a respective second said secret not         selected for access by the recipient, wherein the or each said         second public key is a public key of said elliptic curve         cryptography system and a respective second private key,         corresponding to said second public key, is not available to the         recipient;     -   receiving, at the recipient from the sender, at least one said         first secret encrypted by means of the corresponding said first         public key; and     -   receiving, at the recipient from the sender, at least one said         second secret encrypted by means of the corresponding said         second public key;     -   wherein the or each said first secret is accessible to said         recipient by means of the corresponding said first private key,         the or each said second secret is inaccessible to said         recipient, and said sender is unable to distinguish between a         said first secret and a said second secret.

There may be provided a system, comprising:

-   -   a processor; and     -   memory including executable instructions that, as a result of         execution by the processor, causes the system to perform any         embodiment of the computer-implemented method described herein.

There may be provided a non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by a processor of a computer system, cause the computer system to at least perform an embodiment of the computer-implemented method described herein.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:

FIG. 1 illustrates a message transfer between a sender and a recipient;

FIG. 2 illustrates operation of a Diffie Hellman key exchange;

FIG. 3 illustrates the principle of operation of Oblivious Transfer;

FIGS. 4 and 5 show Oblivious Transfer processes; and

FIG. 6 is a schematic diagram illustrating a computing environment in which various embodiments can be implemented.

DESCRIPTION OF EMBODIMENTS

Referring to FIG. 4 , a method for conducting an Oblivious Transfer process from a sender Bob to a recipient Alice on the Bitcoin blockchain is shown. Bob starts by creating n keys: {k₁, k₂, . . . k_(n)}. These are created deterministically as a subkey of k₀, an elliptic curve digital signature algorithm (ECDSA) master key, by means of a method as disclosed in International patent application WO2017/145016. These n keys will be used in encrypting n different values. Alice seeks to access one and only one of these values without letting Bob know which one was selected. Bob seeks to ensure that Alice can only access a single value and one key at each exchange.

The process starts by Alice and Bob setting up the curve parameters for an elliptic curve cryptography (ECC)/elliptic curve digital signature algorithm (ECDSA) system (such as with Bitcoin).

From the ECDSA mechanism

d _(A) Q _(B) =d _(A) d _(B) G=d _(B) d _(A) G=d _(B) Q _(A)

Where Alice computes a point.

(x _(k) ,y _(k))=d _(A) Q _(B)

And Bob computes a point.

(x _(k) ,y _(k))=d _(B) Q _(A)

x_(K) is a shared secret.

d_(A) and d_(B) are Alice and Bob's private keys respectively.

Q_(A) and Q_(B) are the respective Public keys.

From this basic algorithm a method can be created to exchange a pair of numbers. This logic can be repeated log₂ (n) times to select one of n values. This is done by ensuring that only one pair of keys exchanged is valid.

This first step allows Alice to select one and only one value from 2 possible choices k₀ and k₁.

-   -   1. Alice and Bob start by agreeing on a value C. They use an         ECDSA exchange to select the hash of the current block height         and a secret generated by their master keys. Such an exchange is         described in more detail in International patent application         WO2017/145016 and,

C=h(BH|S) or C=h(BH|S|BLOCkhash)

where h( ) is a hash function, and is the concatenate operator.

BH is block height.

S is shared secret generated, for example, by means of a method disclosed in International patent application WO2017/145016.

Blockhash=Blockhash

It should be noted that any random value can be used but block height is a good source of external agreed randomness.

-   -   2. Alice selects a value. She keeps this to herself. This         value (i) represents a key that Bob created at k_(i).     -   3. Alice then creates a subkey from her master key pair         d_(A)/Q_(A) by means of the method of International patent         application WO2017/145016 and now has Q_(A0) where Q_(A) is the         master key for Q_(A0).

Alice will let Bob know Q_(A0) using the ECDSA exchange first. Bob will encrypt. Bob encrypts Alice's selection k_(i).

To ensure Bob does not know which i=0 or 1 that Alice selected, Alice also creates a decoy public key Q_(A1).

-   -   4. Bob will not know which is the real value.

In the case in which Alice wishes to use private key d_(A0) to decrypt the selected value

-   -   Alice creates a subkey: d_(A0), corresponding to public key         Q_(A0)=(x_(A0),y_(A0))     -   Alice knows d_(A0) and hence Q_(A0)     -   Alice also knows that:

$\begin{matrix} {{d_{A0}Q_{A1}} = {{d_{A0}d_{A1}G} = {d_{A1}d_{A0}G}}} \\ {= {Q_{A0}d_{A1}}} \end{matrix}$

-   -   Alice knows d_(A0) but cannot calculate d_(A1).     -   Next Bob requires that

$\begin{matrix} {{C \equiv x_{A0}} = {d_{A0}Q_{A1}}} \\ {= {d_{A1}Q_{A0}}} \end{matrix}$

Alice knows d_(A0) and can calculate Q_(A1). Q_(A0) is a product of d_(A0) and is known to Alice.

-   -   5. Alice gives Bob both keys.

Q _(A0)

Q _(A1)

Even though Alice can only decode information encrypted for Q_(A0). That is Alice has the private key d_(A0) for Q_(A0) but not the private key d_(A1) for Q_(A1).

-   -   6. Bob encrypts k_(i) to Alice. In this example k₀ is the one         Alice can decrypt. This is as Bob encrypts k₀ to Q_(A0) and         k_(i) to Q_(A1) Bob does not know if Alice wants k₀ or k_(i) but         he knows that she would only have one of the keys d_(A0) or         d_(A1) that are needed to decrypt the packet.     -   7. Bob selects two random values r₀ and r₁. Bob computes two         keys:

Q _(r0) =r ₀ G

Q _(r1) =r ₁ G

and sends these to Alice.

-   -   8. Bob calculates:

h(Q _(A0)) and

h(Q _(A1))

-   -   9. Bob makes the Public keys.

Q _(AB0)=(h(Q _(A0))+r ₀)G

Q _(AB1)=(h(Q _(A1))+r ₁)G

Bob encrypts k₀ and k₁ with Q_(AB0) and Q_(AB1) respectively. Bob sends Q_(r0) and Q_(r1) to Alice:

Q _(r0) =r ₀ G

Q _(r1) =r ₁ G.

-   -   10. Alice cannot reverse to get r₀ or r₁.     -   11. Alice needs to decide but can only decrypt the one value.         (The blank key is of no use). Both Alice and Bob are limited as         follows: Alice can select to decrypt (receive) k₀ or k₁ but not         both and Bob does not know which one so he can send both to her.

In the 1 of 2 system, Alice has two secrets but only seeks to disclose one of them. At the same time Bob does not want Alice to know which of the two secrets he wants. Bob is interested in only one of Alice's secrets but does not want Alice to know which one.

Bob receives one answer only while Alice does not know what Bob wants answered.

FIG. 5 shows operation of a non-interactive Oblivious Transfer protocol, which Alice starts by sending Bob two values: k₀ and k₁. These are sent as functions of Bob's public and private keys such that Bob is able to extract one and only one of the two keys.

An elliptic curve over finite field Z_(p) with (p) as a prime is used. All values are between 0 and (p−1), and all calculations are completed modulo p.

The general form of the elliptic curve equation is:

y ² mod p=(x ³ +ax=b)mod p.

The set of (x,y) points that satisfy the elliptic curve equation is given by E_(p)(a,b). The order r of a point T=(y₁,y₁) on an elliptic curve is defined as the smallest positive integer r such that:

rT=0, where 0 is a point at infinity.

A point G is the base point in E_(p)(a,b). This value is selected such that the order r is very large. The security of the system is based on the elliptic curve discrete logarithm problem (ECDLP) being impracticably difficult to solve. Solving the ECDLP of a point Q is equivalent to solving for an integer k such that

Q=kP (or Q=kG)

Where Q and P are known.

Alice and Bob both use the same Elliptic Curve and base Point G. Alice selects two values, k₀ and k₁ and generates two points P₀ and P₁

P ₀ =k ₀ G

P ₁ =k ₁ G.

The values k₀ and k₁ are not to be known to Bob and act as the secret key held by Alice.

These values can be determined using an exchange process as described in International patent application WO2017/145016.

If Alice has a master key of k_(sa), then the values k₀ and k₁ can be linked to k_(sa)

k _(sa) +v ₀ =k ₀

k _(sa) +v ₁ =k ₁

Where v₀ and v₁ are values known by Alice. This process can be completed before the Oblivious Transfer message exchange.

The protocol is defined as follows:

Referring to FIG. 5 , beginning with base point G and points P₀ and P₁.

Let: P=P ₀ +P ₁

And i∈{0,1}.

-   -   1. Bob creates Public keys (U₀, U₁) by selecting a random         integer in and setting:

U _(i) =mG,

-   -    where U_(i) represents which of U₀ or U₁ corresponds to k₀ or         k₁ Bob has selected. Bob sends public keys U₀ and U₁ to Alice.

Next let U_(b)=mG−P_(i)

U _(1-i) =P _(1-i) −U _(b)

Bob's private key is m. m can be derived using a process as described in International patent application WO2017/145016.

-   -   2. Alice selects two random integers a₀ and a₁ and computes:

V ₀ =a ₀ G

And

V ₁ =a ₁ G.

Alice then computes:

W ₀ =a ₀ U ₀

And

W ₁ =a ₁ U ₁

Alice sends the values V₀, V₁, to Bob.

Alice then computes:

X ₀ =S ₀ ⊕W ₀

And

X ₁ =S ₁ ⊕W ₁

Where S_(i)⊕W_(i) represents encryption of the binary representation of secret value S_(i) by means of an exclusive OR cipher which has the binary representation of W_(i) as an encryption key.

Alice also sends X₀ and X₁ to Bob.

-   -   3. Bob computes the values:

mV _(i) =ma _(i) G=W _(i)

This allows him to extract S_(i) as

S _(i) =W _(i) ⊕X _(i)

S_(i) is the i^(th) secret.

It should be noted that Bob cannot extract S_(1-i) as he cannot compute n where U_(1-i)=nG. Alice does not know which value of U₀ or U₁ equals m G such that Bob is able to determine the value of Alice therefore does not know which of the two secrets Bob has received.

Alice can validate that Bob's public keys are correctly formed by

Checking that U _(i) +U _(1-i) =P  1.

Computing U _(b) =U _(i) −P _(i)  2.

This is used to verify if it is the negative of U_(1-i)−P_(1-i)

Security aspects of the protocol are as follows:

-   -   1. Alice cannot deduce which of the two secrets Bob has         received.     -   2. The security of the protocol holds if the discrete logarithm         problem (DLP) holds for elliptic curves.     -   3. If Alice follows the protocol, Bob can only find one of her         secrets.

This system allows for a fair control over an exchange. Bob and Alice can exchange information without knowing what was exchanged. This can be used to control all browsing of data or information, access to databases, and other records (for example, medical files), and this information can be segmented and divulged bit by bit with a record of which parties saw what information. It can eliminate the need for a trusted server or third party.

Turning now to FIG. 6 , there is provided an illustrative, simplified block diagram of a computing device 2600 that may be used to practice at least one embodiment of the present disclosure. In various embodiments, the computing device 2600 may be used to implement any of the systems illustrated and described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 6 , the computing device 2600 may include one or more processors with one or more levels of cache memory and a memory controller (collectively labelled 2602) that can be configured to communicate with a storage subsystem 2606 that includes main memory 2608 and persistent storage 2610.

The main memory 2608 can include dynamic random-access memory (DRAM) 2618 and read-only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 and may be used for storage of information, such as details associated with transactions and blocks as described in the present disclosure. The processor(s) 2602 may be utilized to provide the steps or functionality of any embodiment as described in the present disclosure.

The processor(s) 2602 can also communicate with one or more user interface input devices 2612, one or more user interface output devices 2614, and a network interface subsystem 2616.

A bus subsystem 2604 may provide a mechanism for enabling the various components and subsystems of computing device 2600 to communicate with each other as intended. Although the bus subsystem 2604 is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple busses.

The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616 may serve as an interface for receiving data from, and transmitting data to, other systems from the computing device 2600. For example, the network interface subsystem 2616 may enable a data technician to connect the device to a network such that the data technician may be able to transmit data to the device and receive data from the device while in a remote location, such as a data centre.

The user interface input devices 2612 may include one or more user input devices such as a keyboard; pointing devices such as an integrated mouse, trackball, touchpad, or graphics tablet; a scanner; a barcode scanner; a touch screen incorporated into the display; audio input devices such as voice recognition systems, microphones; and other types of input devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information to the computing device 2600.

The one or more user interface output devices 2614 may include a display subsystem, a printer, or non-visual displays such as audio output devices, etc. The display subsystem may be a cathode ray tube (CRT), a flat-panel device such as a liquid crystal display (LCD), light emitting diode (LED) display, or a projection or other display device. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present user interfaces to facilitate user interaction with applications performing processes described and variations therein, when such interaction may be appropriate.

The storage subsystem 2606 may provide a computer-readable storage medium for storing the basic programming and data constructs that may provide the functionality of at least one embodiment of the present disclosure. The applications (programs, code modules, instructions), when executed by one or more processors, may provide the functionality of one or more embodiments of the present disclosure, and may be stored in the storage subsystem 2606. These application modules or instructions may be executed by the one or more processors 2602. The storage subsystem 2606 may additionally provide a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and cache memory 2602 can provide volatile storage for program and data. The persistent storage 2610 can provide persistent (non-volatile) storage for program and data and may include flash memory, one or more solid state drives, one or more magnetic hard disk drives, one or more floppy disk drives with associated removable media, one or more optical drives (e.g., CD-ROM or DVD or Blue-Ray) drive with associated removable media, and other like storage media. Such program and data can include programs for carrying out the steps of one or more embodiments as described in the present disclosure as well as data associated with transactions and blocks as described in the present disclosure.

The computing device 2600 may be of various types, including a portable computer device, tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that may be connected to the computing device 2600 through one or more ports (e.g., USB, a headphone jack, Lightning connector, etc.). The device that may be connected to the computing device 2600 may include a plurality of ports configured to accept fibre-optic connectors. Accordingly, this device may be configured to convert optical signals to electrical signals that may be transmitted through the port connecting the device to the computing device 2600 for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 depicted in FIG. 6 is intended only as a specific example for purposes of illustrating the preferred embodiment of the device. Many other configurations having more or fewer components than the system depicted in FIG. 6 are possible.

Enumerated Example Embodiments

Examples of the embodiments of the present disclosure can be described in view of the following clauses:

-   -   1. A method of communicating at least one secret from a sender         to a recipient, the method comprising:     -   sending, from the sender to the recipient, information         identifying a plurality of secrets selectable by the recipient;     -   receiving, at the sender, from the recipient, at least one first         public key, corresponding to a respective first said secret         selected for access by the recipient, wherein the or each said         first public key is part of a public key/private key pair of an         elliptic curve cryptography system and a first private key         corresponding to said first public key is accessible to the         recipient;     -   receiving, at the sender, from the recipient, at least one         second public key, corresponding to a respective second said         secret not selected for access by the recipient, wherein the or         each said second public key is a public key of said elliptic         curve cryptography system and a respective second private key,         corresponding to said second public key, is not available to the         recipient;     -   sending, from the sender to the recipient, at least one said         first secret encrypted by means of the corresponding said first         public key; and     -   sending, from the sender to the recipient, at least one said         second secret encrypted by means of the corresponding said         second public key;     -   wherein the or each said first secret is accessible to said         recipient by means of the corresponding said first private key,         the or each said second secret is inaccessible to said         recipient, and said sender is unable to distinguish between a         said first secret and a said second secret.     -   This provides the advantage of improving security of data of the         method by only allowing a recipient to have access to a limited         number of messages, while preventing the sender from knowing         which message or messages the recipient has accessed.     -   2. A method according to clause 1, further comprising encrypting         at least one said first secret by means of the corresponding         said first public key and encrypting at least one said second         secret by means of the corresponding said second public key.     -   3. A method according to clause 2, wherein at least one said         first secret and at least one said second secret are encrypted         by means of a respective exclusive OR cipher.     -   This provides the advantage of enabling rapid and efficient         encryption and decryption.     -   4. A method according to clause 3, wherein at least one said         exclusive OR cipher has a respective encryption key based on the         corresponding said first or second public key.     -   5. A method according to clause 4, wherein at least one said         encryption key comprises the corresponding said first or second         public key, multiplied by a respective first or second         encryption integer, known to the sender, by means of scalar         elliptic curve point multiplication.     -   6. A method according to clause 5, further comprising sending,         from said sender to said recipient, at least one said first         and/or second encryption integer, encrypted by means of the         corresponding said first or second public key.     -   7. A method according to any one of the preceding clauses,         wherein at least one said first secret is encrypted by means of         a respective third public key containing a respective first         masking term comprising a result of scalar multiplication, by a         respective first masking integer, known to the sender, of an         elliptic curve generator point of the elliptic curve         cryptography system, added to a respective first encryption term         by means of elliptic curve point addition.     -   8. A method according to clause 7, wherein at least one said         first encryption term comprises a result of scalar         multiplication of the elliptic curve generator point by a         respective third encryption integer dependent on the         corresponding said first public key.     -   9. A method according to clause 8, wherein at least one said         third encryption integer is a hash value of the corresponding         said first public key.     -   10. A method according to any one of clauses 7 to 9, wherein at         least one said second secret is encrypted by means of a         respective fourth public key containing a respective second         masking term comprising a result of scalar multiplication, by a         respective second masking integer, known to the sender, of the         elliptic curve generator point of the elliptic curve         cryptography system, added to a respective second encryption         term by means of elliptic curve point addition.     -   11. A method according to clause 10, wherein at least one said         second encryption term comprises a result of scalar         multiplication of the elliptic curve generator point by a         respective fourth encryption integer dependent on the         corresponding said second public key.     -   12. A method according to clause 11, wherein at least one said         fourth encryption integer is a hash value of the corresponding         said second public key.     -   13. A method according to any one of the preceding clauses,         wherein at least one said first and/or second public key can be         determined from the corresponding said second and/or first         public key.     -   14. A method according to any one of the preceding clauses,         further comprising generating at least one third secret, to be         shared between the sender and the recipient.     -   15. A method according to clauses 13 and 14, wherein at least         one said first and/or second public key is based on the         corresponding said second and/or first public key and at least         one said third secret.     -   16. A method according to any one of the preceding clauses,         further comprising checking, at said sender, consistency of at         least one said first and/or second public key, received from the         recipient, with the corresponding said second and/or first         public key received from the recipient.     -   17. A method according to any one of the preceding clauses,         wherein a result of scalar multiplication of at least one said         first public key by a said second private key is equal to a         result of scalar multiplication of a respective said second         public key by a respective said first private key.     -   18. A method according to any one of the preceding clauses,         wherein at least one said first private key and at least one         said second private key are derived deterministically from a         private key of said elliptic curve cryptography system known to         the sender.     -   19. A method of receiving at least one secret sent from a sender         to a recipient, the method comprising:     -   receiving, at the recipient, information identifying a plurality         of secrets selectable by the recipient;     -   sending, to the sender, from the recipient, at least one first         public key, corresponding to a respective first said secret         selected for access by the recipient, wherein the or each said         first public key is part of a public key/private key pair of an         elliptic curve cryptography system and a first private key         corresponding to said first public key is accessible to the         recipient;     -   sending, to the sender, from the recipient, at least one second         public key, corresponding to a respective second said secret not         selected for access by the recipient, wherein the or each said         second public key is a public key of said elliptic curve         cryptography system and a respective second private key,         corresponding to said second public key, is not available to the         recipient;     -   receiving, at the recipient from the sender, at least one said         first secret encrypted by means of the corresponding said first         public key; and     -   receiving, at the recipient from the sender, at least one said         second secret encrypted by means of the corresponding said         second public key;     -   wherein the or each said first secret is accessible to said         recipient by means of the corresponding said first private key,         the or each said second secret is inaccessible to said         recipient, and said sender is unable to distinguish between a         said first secret and a said second secret.     -   20. A method according to clause 19, wherein at least one said         first secret and at least one said second secret are encrypted         by means of a respective exclusive OR cipher.     -   21. A method according to clause 20, wherein at least one said         exclusive OR cipher has a respective encryption key based on the         corresponding said first or second public key.     -   22. A method according to clause 21, wherein at least one said         encryption key comprises the corresponding said first or second         public key, multiplied by a respective first or second         encryption integer, known to the sender, by means of scalar         elliptic curve point multiplication.     -   23. A method according to clause 22, further comprising         receiving, at said recipient from said sender, at least one said         first and/or second encryption integer, encrypted by means of         the corresponding said first or second public key.     -   24. A method according to any one of clauses 19 to 23, wherein         at least one said first secret is encrypted by means of a         respective third public key containing a respective first         masking term comprising a result of scalar multiplication, by a         respective first masking integer, known to the sender, of an         elliptic curve generator point of the elliptic curve         cryptography system, added to a respective first encryption term         by means of elliptic curve point addition.     -   25. A method according to clause 24, wherein at least one said         first encryption term comprises a result of scalar         multiplication of the elliptic curve generator point by a         respective third encryption integer dependent on the         corresponding said first public key.     -   26. A method according to clause 25, wherein at least one said         third encryption integer is a hash value of the corresponding         said first public key.     -   27. A method according to any one of clauses 24 to 26, wherein         at least one said second secret is encrypted by means of a         respective fourth public key containing a respective second         masking term comprising a result of scalar multiplication, by a         respective second integer, known to the sender, of the elliptic         curve generator point of the elliptic curve cryptography system,         added to a respective second encryption term by means of         elliptic curve point addition.     -   28. A method according to clause 27, wherein at least one said         second encryption term comprises a result of scalar         multiplication of the elliptic curve generator point by a         respective fourth encryption integer dependent on the         corresponding said second public key.     -   29. A method according to clause 28, wherein at least one said         fourth encryption integer is a hash value of the corresponding         said second public key.     -   30. A method according to any one of clauses 19 to 29, wherein         at least one said first and/or second public key can be         determined from the corresponding said second and/or first         public key.     -   31. A method according to any one of clauses 19 to 30, further         comprising generating at least one third secret, to be shared         between the sender and the recipient.     -   32. A method according to clauses 30 and 31, wherein at least         one said first and/or second public key is based on the         corresponding said second and/or first public key and at least         one said third secret.     -   33. A method according to any one of clauses 19 to 32, wherein a         result of scalar multiplication of at least one said first         public key by a said second private key is equal to a result of         scalar multiplication of a respective said second public key by         a respective said first private key.

A computer implemented system arranged to carry out a method according to any one of the preceding clauses.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be capable of designing many alternative embodiments without departing from the scope of the invention as defined by the appended claims. In the claims, any reference signs placed in parentheses shall not be construed as limiting the claims. The word “comprising” and “comprises”, and the like, does not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In the present specification, “comprises” means “includes or consists of” and “comprising” means “including or consisting of”. The singular reference of an element does not exclude the plural reference of such elements and vice-versa. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

1 REFERENCES

-   [1] “Generalised Oblivious Transfer Protocol”, Partha Sarathi Roy,     Department of Pure mathematics, University Cacutta India -   [2] “Generalised oblivious transfer by secret sharing” Tamir Tassa -   [3] “Computationally secure oblivious transfer” Moni Naor, Benny     Pinkas -   [4] “The simplest protocol for oblivious transfer” Tung Chou and     Claudio Orlandi -   [5] “Smooth projective hashing and two message oblivious transfer”     Yuri Tauman KAlai MIT -   [6] “Oblivious Transfer with Access Control” Jan Camenisch, Maria     Dubovitskaya, Gregory Neven -   [7] “Practical Fully Simulatable Oblivious Transfer with Sub-linear     communication” BingSheng Zhang, Helger Lipmaa, Cong Wang, Kuri Ren -   [8] Rabin (1981) for papers on oblivious transfer -   [9] Bellare M.; Micalli, S. [1989] “Non-Interactive Oblivious     Transfer and Applications.” Proc. On Adv in Cryptography CRYPTO 89.     PP 547-557. -   [10] Diffie, W.; Hellman, M. (1976). “New directions in     cryptography” (PDF). IEEE Transactions on Information Theory. 22     (6): 644-654. doi:10.1109/TIT.1976.1055638. -   [11] Prof Bill Buchanan, www.asecuritysite.com -   [12] Boneh, Franklin, “Identity-Based Encryption from the Weil     Pairing”. Appears in SIAM J. of Computing, Vol. 32, No. 3, pp.     586-615, 2003. An extended abstract of this paper appears in the     Proceedings of Crypto 2001, volume 2139 of Lecture Notes in Computer     Science, pages 213-229, Springer-Verlag, 2001. “Bilinear paring.” 

1-34. (canceled)
 35. A method of communicating at least one secret from a sender to a recipient, the method comprising: sending, from the sender to the recipient, information identifying a plurality of secrets selectable by the recipient; generating a third secret, to be shared between the sender and the recipient, from master keys held by the sender and recipient; receiving, at the sender, from the recipient, at least one first public key, corresponding to a respective first the secret selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to the first public key is accessible to the recipient; receiving, at the sender, from the recipient, at least one second public key, corresponding to a respective second the secret not selected for access by the recipient, wherein the at least one second public key is a public key of the elliptic curve cryptography system and a respective second private key, corresponding to the second public key, is not available to the recipient, wherein the at least one second public key is based on a corresponding first public key/private key pair and the third secret; sending, from the sender to the recipient, a first secret encrypted by means of the corresponding first public key; and sending, from the sender to the recipient, a second secret encrypted by means of the corresponding second public key, wherein the first secret is accessible to the recipient by means of the corresponding first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first secret and the second secret.
 36. The method according to claim 35, further comprising encrypting the first secret by means of the corresponding first public key and encrypting the second secret by means of the corresponding second public key.
 37. The method according to claim 35, wherein the first secret is encrypted by means of a respective third public key containing a respective first masking term comprising a result of scalar multiplication, by a respective first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a respective first encryption term by means of elliptic curve point addition.
 38. The method according to claim 37, wherein the respective first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a respective third encryption integer dependent on the corresponding first public key.
 39. The method according to claim 38, wherein the respective third encryption integer is a hash value of the corresponding first public key.
 40. The method according to claim 37, wherein the second secret is encrypted by means of a respective fourth public key containing a respective second masking term comprising a result of scalar multiplication, by a respective second masking integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a respective second encryption term by means of elliptic curve point addition.
 41. The method according to claim 40, wherein the respective second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a respective fourth encryption integer dependent on the corresponding second public key.
 42. The method according to claim 41, wherein the respective fourth encryption integer is a hash value of the corresponding second public key.
 43. The method according to claim 35, wherein a result of scalar multiplication of the at least one first public key by the second private key is equal to a result of scalar multiplication of a respective second public key by a respective first private key.
 44. The method according to claim 35, wherein the first private key is derived deterministically from a private key of the elliptic curve cryptography system known to the sender.
 45. A method of receiving at least one secret sent from a sender to a recipient, the method comprising: receiving, at the recipient, information identifying a plurality of secrets selectable by the recipient; generating a third secret, to be shared between the sender and the recipient, from master keys held by the sender and recipient; sending, to the sender, from the recipient, at least one first public key, corresponding to a respective first the secret selected for access by the recipient, wherein the first public key is part of a public key/private key pair of an elliptic curve cryptography system and a first private key corresponding to the first public key is accessible to the recipient, wherein at least one second public key is based on a corresponding first public key/private key pair and the third secret; sending, to the sender, from the recipient, the at least one second public key, corresponding to a respective second the secret not selected for access by the recipient, wherein the at least one second public key is a public key of the elliptic curve cryptography system and a respective second private key, corresponding to the second public key, is not available to the recipient; receiving, at the recipient from the sender, a first secret encrypted by means of the corresponding first public key; and receiving, at the recipient from the sender, a second secret encrypted by means of the corresponding second public key, wherein the first secret is accessible to the recipient by means of the corresponding first private key, the second secret is inaccessible to the recipient, and the sender is unable to distinguish between the first secret and the second secret.
 46. The method according to claim 45, wherein the first secret is encrypted by means of a respective third public key containing a respective first masking term comprising a result of scalar multiplication, by a respective first masking integer, known to the sender, of an elliptic curve generator point of the elliptic curve cryptography system, added to a respective first encryption term by means of elliptic curve point addition.
 47. The method according to claim 46, wherein the respective first encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a respective third encryption integer dependent on the corresponding first public key.
 48. The method according to claim 47, wherein the respective third encryption integer is a hash value of the corresponding first public key.
 49. The method according to claim 46, wherein the second secret is encrypted by means of a respective fourth public key containing a respective second masking term comprising a result of scalar multiplication, by a respective second integer, known to the sender, of the elliptic curve generator point of the elliptic curve cryptography system, added to a respective second encryption term by means of elliptic curve point addition.
 50. The method according to claim 49, wherein the respective second encryption term comprises a result of scalar multiplication of the elliptic curve generator point by a respective fourth encryption integer dependent on the corresponding second public key.
 51. The method according to claim 50, wherein the respective fourth encryption integer is a hash value of the corresponding second public key.
 52. The method according to claim 45, wherein a result of scalar multiplication of the at least one first public key by the second private key is equal to a result of scalar multiplication of a respective second public key by a respective first private key.
 53. The method according to claim 45, wherein the first private key is derived deterministically from a private key of the elliptic curve cryptography system known to the sender.
 54. A computer-implemented system arranged to carry out the method according to claim
 45. 